Subj : One of the worst Mac malware strains is back and hiding as a prod
To   : All
From : TechnologyDaily
Date : Wed Aug 23 2023 13:15:03

One of the worst Mac malware strains is back and hiding as a productivity app 
- so beware

Date:
Wed, 23 Aug 2023 12:04:04 +0000

Description:
No, OfficeNote is not a real app - it's a piece of Mac malware looking to 
steal your secrets.

FULL STORY
======================================================================

If you stumble upon an app that claims to be a productivity solution called 
OfficeNote, ignore it and walk away - its just a piece of malware trying to 
steal sensitive data from your macOS device. 

Cybersecurity researchers from SentinelOne recently published a blog post 
detailing their discovery of a brand new version of XLoader, an 
eight-year-old malware-as-a-service which now comes written in an entirely 
different programming language, but capable of wreaking just as much havoc as 
before. 

As per the report, XLoader is an infostealer and a botnet thats capable of 
stealing secrets stored in peoples browsers, and more. The older versions 
were written in Java, but given that macOS no longer supports it by default, 
the new version is written from scratch in C and Objective C. Furthermore, 
its shipped with an Apple developer signature MAIT JAKHU (54YDV8NU9C). The 
researchers did not elaborate on how the attackers obtained this signature. 
Rising in popularity 

In any case, the signature has since been revoked by Apple, but Cupertinos 
built-in malware blocker, XProtect, is yet to start spotting the malware, 
they say. 

The infostealer is growing immensely popular, the researchers further claim, 
saying that multiple submissions popped up on VirusTotal last month, an 
indication of rising popularity. On the dark web, the Mac version of the 
service costs $199/month, or $200 a month for three months - quite the price 
hike compared to the Windows version ($59 a month, or $129 for three months). 
Read more 

> Learn coding skills with the best Python online courses 


 > More malware is being hidden in PNG images, so watch out 


 > Check out the best productivity tools around 

If you do end up installing OfficeNote on your endpoint, youll get a message 
saying the application doesnt work. In the background, however, the 
application works just as intended, dropping payloads and installing 
persistence agents. If it runs unchecked, the malware will try to steal 
secrets from the users clipboard, and look for secrets in Chrome and Firefox. 
Interestingly enough, Safari isnt being targeted. 

Finally, XLoader tries really hard to keep its C2 server a secret, using 
multiple dummy network calls to throw researchers off their trail. 
SentinelOne observed 169 DNS name resolutions and 203 HTTP requests. Check 
out the best firewalls around



======================================================================
Link to news story:
https://www.techradar.com/pro/security/one-of-the-worst-mac-malware-strains-is
-back-and-hiding-as-a-productivity-app-so-beware


--- Mystic BBS v1.12 A47 (Linux/64)
 * Origin: tqwNet Technology News (1337:1/100)

.